MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e50d704ac52bb66fc8fae0b4b54a7538800d3b1c2cad69a0210ca9c97978cb04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 11
| SHA256 hash: | e50d704ac52bb66fc8fae0b4b54a7538800d3b1c2cad69a0210ca9c97978cb04 |
|---|---|
| SHA3-384 hash: | a60f6862e5acf97ef5afc39d4032f72780c1973e23bfe6037a35934f1f7b38a85243da211e28bda16a181d815f9ce139 |
| SHA1 hash: | a7311cef83e8ed0e0f29ef04aef581e3deeb9ee7 |
| MD5 hash: | dd63cc34192462ccbcdf6182c54756fc |
| humanhash: | uncle-steak-twelve-march |
| File name: | SecuriteInfo.com.W32.AIDetect.malware1.22276.30855 |
| Download: | download sample |
| File size: | 46'080 bytes |
| First seen: | 2022-08-29 10:58:01 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a05447f0ae48d23baab89cafdbca9a16 |
| ssdeep | 768:5lyqDQ/PSuSCrFcNJuKxSGy9e3rUNuUGRLMMJQrds:5g/SuSCuZyk3YNuUGFMMCds |
| TLSH | T1CD23BF19F2408465E5B280B544FB965A1A28FE1B072D28F737D02C5F6F33DC6EE3156A |
| TrID | 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.3% (.EXE) OS/2 Executable (generic) (2029/13) 8.3% (.EXE) Clipper DOS Executable (2018/12) |
| File icon (PE): |  |
| dhash icon | b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.22276.30855
Verdict:
Malicious activity
Analysis date:
2022-08-29 11:03:30 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for synchronization primitives
Moving of the original file
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Signature
Found evasive API chain (may stop execution after checking computer name)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Bingoml
Status:
Malicious
First seen:
2022-08-29 02:03:18 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Downloads MZ/PE file
Unpacked files
SH256 hash:
e50d704ac52bb66fc8fae0b4b54a7538800d3b1c2cad69a0210ca9c97978cb04
MD5 hash:
dd63cc34192462ccbcdf6182c54756fc
SHA1 hash:
a7311cef83e8ed0e0f29ef04aef581e3deeb9ee7
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe e50d704ac52bb66fc8fae0b4b54a7538800d3b1c2cad69a0210ca9c97978cb04
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.